Rewrite server: FastAPI + auth (users/roles/tokens) + admin WebUI + server-authoritative covers/metadata

server/__init__.py

@@ -0,0 +1 @@
+"""psppt server package (FastAPI + admin WebUI)."""

server/api.py

@@ -0,0 +1,491 @@
+"""REST API for the psppt server (JSON, token-authenticated).
+
+Endpoints:
+  POST   /api/auth/login                 -> {token, username, role}
+  GET    /api/auth/me                    -> current user
+  POST   /api/auth/logout                -> revoke current token
+  GET    /api/users                      -> list (admin)
+  POST   /api/users                      -> create (admin)
+  PATCH  /api/users/{id}                 -> update role/password/active (admin)
+  DELETE /api/users/{id}                 -> delete (admin)
+  GET    /api/users/{id}/tokens          -> list API tokens (admin or self)
+  DELETE /api/users/{id}/tokens/{tid}    -> revoke a token (admin or self)
+  GET    /api/releases?system=&q=&limit=  -> catalog list
+  GET    /api/releases/{id}              -> detail + metadata + roms
+  PATCH  /api/releases/{id}              -> edit metadata (editor+)
+  GET    /api/cover/{id}                 -> cover image
+  POST   /api/cover/{id}                 -> upload/replace cover (editor+)
+  DELETE /api/cover/{id}                 -> delete cover (editor+)
+  GET    /api/store?system=games|videos  -> archive list
+  GET    /api/store/download/{system}/{name}  -> stream archive
+  POST   /api/store/upload?system=       -> upload archive (editor+)
+  DELETE /api/store/{system}/{name}      -> delete archive (editor+)
+  GET    /api/stats                      -> dashboard numbers (admin)
+"""
+import json
+import re
+from pathlib import Path
+
+from fastapi import APIRouter, Depends, File, Header, HTTPException, Query, Request, UploadFile
+from fastapi.responses import FileResponse, JSONResponse
+
+from app import covers, store
+from app.db import get_connection
+
+from . import config
+from .security import now_iso, require_role, revoke_token, get_current_user, hash_password, verify_password, issue_token
+
+router = APIRouter(prefix="/api")
+
+_META_FIELDS = ("release_date", "developer", "publisher", "genre", "synopsis", "title")
+_SAFE_NAME_RE = re.compile(r"[^A-Za-z0-9._()\- ]")
+
+
+# --------------------------------------------------------------------------- #
+# helpers
+# --------------------------------------------------------------------------- #
+def _conn():
+    return get_connection()
+
+
+def _release_system(conn, release_id):
+    row = conn.execute(
+        "SELECT d.system FROM releases r JOIN dats d ON d.id = r.dat_id WHERE r.id = ?",
+        (release_id,),
+    ).fetchone()
+    return row["system"] if row else None
+
+
+def _metadata(conn, release_id, system):
+    row = conn.execute(
+        "SELECT title, meta_json, manual FROM item_info WHERE release_id = ? AND system = ?",
+        (str(release_id), system),
+    ).fetchone()
+    meta = {}
+    if row and row["meta_json"]:
+        try:
+            meta = json.loads(row["meta_json"])
+        except (TypeError, ValueError):
+            meta = {}
+    if row:
+        meta["title"] = row["title"]
+        meta["manual"] = bool(row["manual"])
+    return meta
+
+
+def _save_metadata(conn, release_id, system, fields):
+    key = str(release_id)
+    row = conn.execute(
+        "SELECT meta_json FROM item_info WHERE release_id = ? AND system = ?", (key, system)
+    ).fetchone()
+    meta = {}
+    if row and row["meta_json"]:
+        try:
+            meta = json.loads(row["meta_json"])
+        except (TypeError, ValueError):
+            meta = {}
+    meta.update(fields)
+    title = fields.get("title") or meta.get("title") or ""
+    conn.execute(
+        "INSERT INTO item_info (release_id, system, title, meta_json, manual, updated_at) "
+        "VALUES (?, ?, ?, ?, 1, ?) "
+        "ON CONFLICT(release_id, system) DO UPDATE SET "
+        "title = excluded.title, meta_json = excluded.meta_json, manual = 1, updated_at = excluded.updated_at",
+        (key, system, title, json.dumps(meta, ensure_ascii=False), now_iso()),
+    )
+
+
+def _cover_paths(release_id, system):
+    base = config.COVERS_DIR / system / str(release_id)
+    return base, [base.with_suffix(ext) for ext in (".png", ".jpg", ".jpeg", ".webp")]
+
+
+def _find_cover(release_id, system):
+    base, candidates = _cover_paths(release_id, system)
+    for p in candidates:
+        if p.exists():
+            return p
+    return base.with_suffix(".png")
+
+
+def _save_cover(release_id, system, data):
+    base, candidates = _cover_paths(release_id, system)
+    base.parent.mkdir(parents=True, exist_ok=True)
+    ext = ".png"
+    if data[:3] == b"\xff\xd8\xff":
+        ext = ".jpg"
+    elif data[:4] == b"RIFF" and data[8:12] == b"WEBP":
+        ext = ".webp"
+    dest = base.with_suffix(ext)
+    for p in candidates:
+        if p.exists() and p != dest:
+            p.unlink()
+    tmp = dest.with_name(dest.name + ".tmp")
+    tmp.write_bytes(data)
+    tmp.replace(dest)
+    return dest
+
+
+def _store_root(system):
+    return config.STORE_VIDEOS_ROOT if system == "videos" else config.STORE_ROOT
+
+
+def _log_download(user, system, name, size):
+    conn = _conn()
+    try:
+        conn.execute(
+            "INSERT INTO download_events (user_id, system, name, bytes, created_at) VALUES (?, ?, ?, ?, ?)",
+            (user["id"] if user else None, system, name, size or 0, now_iso()),
+        )
+        conn.commit()
+    finally:
+        conn.close()
+
+
+# --------------------------------------------------------------------------- #
+# auth
+# --------------------------------------------------------------------------- #
+@router.post("/auth/login")
+def auth_login(payload: dict):
+    username = (payload.get("username") or "").strip()
+    password = payload.get("password") or ""
+    conn = _conn()
+    try:
+        row = conn.execute(
+            "SELECT id, username, password_hash, role, is_active FROM users WHERE username = ?",
+            (username,),
+        ).fetchone()
+    finally:
+        conn.close()
+    if row is None or not row["is_active"] or not verify_password(password, row["password_hash"]):
+        raise HTTPException(status_code=401, detail="Invalid username or password")
+    token = issue_token(row["id"], kind="api", label="desktop")
+    return {"token": token, "username": row["username"], "role": row["role"], "user_id": row["id"]}
+
+
+@router.get("/auth/me")
+def auth_me(user=Depends(get_current_user)):
+    return user
+
+
+@router.post("/auth/logout")
+def auth_logout(request: Request, authorization: str = Header(default="")):
+    token = ""
+    if authorization.startswith("Bearer "):
+        token = authorization[7:].strip()
+    else:
+        token = request.cookies.get("psppt_session", "")
+    if token:
+        revoke_token(token)
+    return {"ok": True}
+
+
+# --------------------------------------------------------------------------- #
+# users (admin)
+# --------------------------------------------------------------------------- #
+@router.get("/users")
+def users_list(user=Depends(require_role("admin"))):
+    conn = _conn()
+    try:
+        rows = conn.execute(
+            "SELECT id, username, role, is_active, created_at, last_login_at FROM users ORDER BY username"
+        ).fetchall()
+        return {"items": [dict(r) for r in rows]}
+    finally:
+        conn.close()
+
+
+@router.post("/users")
+def users_create(payload: dict, user=Depends(require_role("admin"))):
+    username = (payload.get("username") or "").strip()
+    password = payload.get("password") or ""
+    role = payload.get("role") or "user"
+    if not username or not password:
+        raise HTTPException(status_code=400, detail="username and password are required")
+    if role not in ("admin", "editor", "user"):
+        raise HTTPException(status_code=400, detail="invalid role")
+    conn = _conn()
+    try:
+        try:
+            conn.execute(
+                "INSERT INTO users (username, password_hash, role, is_active, created_at) VALUES (?, ?, ?, 1, ?)",
+                (username, hash_password(password), role, now_iso()),
+            )
+            conn.commit()
+        except Exception:
+            raise HTTPException(status_code=409, detail="username already exists")
+        row = conn.execute("SELECT id, username, role, is_active FROM users WHERE username = ?", (username,)).fetchone()
+        return dict(row)
+    finally:
+        conn.close()
+
+
+@router.patch("/users/{user_id}")
+def users_update(user_id: int, payload: dict, user=Depends(require_role("admin"))):
+    conn = _conn()
+    try:
+        row = conn.execute("SELECT id FROM users WHERE id = ?", (user_id,)).fetchone()
+        if row is None:
+            raise HTTPException(status_code=404, detail="not found")
+        if "role" in payload:
+            if payload["role"] not in ("admin", "editor", "user"):
+                raise HTTPException(status_code=400, detail="invalid role")
+            conn.execute("UPDATE users SET role = ? WHERE id = ?", (payload["role"], user_id))
+        if "is_active" in payload:
+            conn.execute("UPDATE users SET is_active = ? WHERE id = ?", (1 if payload["is_active"] else 0, user_id))
+        if payload.get("password"):
+            conn.execute("UPDATE users SET password_hash = ? WHERE id = ?", (hash_password(payload["password"]), user_id))
+        conn.commit()
+        row = conn.execute("SELECT id, username, role, is_active FROM users WHERE id = ?", (user_id,)).fetchone()
+        return dict(row)
+    finally:
+        conn.close()
+
+
+@router.delete("/users/{user_id}")
+def users_delete(user_id: int, user=Depends(require_role("admin"))):
+    if user_id == user["id"]:
+        raise HTTPException(status_code=400, detail="cannot delete yourself")
+    conn = _conn()
+    try:
+        conn.execute("DELETE FROM users WHERE id = ?", (user_id,))
+        conn.commit()
+    finally:
+        conn.close()
+    return {"ok": True}
+
+
+@router.get("/users/{user_id}/tokens")
+def users_tokens(user_id: int, user=Depends(require_role("admin"))):
+    conn = _conn()
+    try:
+        rows = conn.execute(
+            "SELECT id, label, kind, created_at, last_used_at, expires_at, revoked_at FROM api_tokens "
+            "WHERE user_id = ? ORDER BY id DESC",
+            (user_id,),
+        ).fetchall()
+        return {"items": [dict(r) for r in rows]}
+    finally:
+        conn.close()
+
+
+@router.delete("/users/{user_id}/tokens/{token_id}")
+def users_revoke_token(user_id: int, token_id: int, user=Depends(require_role("admin"))):
+    conn = _conn()
+    try:
+        conn.execute(
+            "UPDATE api_tokens SET revoked_at = ? WHERE id = ? AND user_id = ?",
+            (now_iso(), token_id, user_id),
+        )
+        conn.commit()
+    finally:
+        conn.close()
+    return {"ok": True}
+
+
+# --------------------------------------------------------------------------- #
+# releases / catalog
+# --------------------------------------------------------------------------- #
+@router.get("/releases")
+def releases_list(system: str = Query(default=""), q: str = Query(default=""), limit: int = 50, offset: int = 0):
+    limit = max(1, min(limit, 500))
+    offset = max(0, offset)
+    sql = "SELECT r.id, d.system, r.name, r.region, r.serial FROM releases r JOIN dats d ON d.id = r.dat_id"
+    where, params = [], []
+    if system:
+        where.append("d.system = ?")
+        params.append(system)
+    if q:
+        where.append("r.name LIKE ?")
+        params.append(f"%{q}%")
+    if where:
+        sql += " WHERE " + " AND ".join(where)
+    sql += " ORDER BY r.name LIMIT ? OFFSET ?"
+    params += [limit, offset]
+    conn = _conn()
+    try:
+        rows = conn.execute(sql, params).fetchall()
+        items = []
+        for r in rows:
+            d = dict(r)
+            d["cover"] = f"/api/cover/{d['id']}"
+            items.append(d)
+        return {"items": items, "limit": limit, "offset": offset}
+    finally:
+        conn.close()
+
+
+@router.get("/releases/{release_id}")
+def releases_detail(release_id: int):
+    conn = _conn()
+    try:
+        rel = conn.execute(
+            "SELECT r.id, d.system, r.name, r.description, r.region, r.serial "
+            "FROM releases r JOIN dats d ON d.id = r.dat_id WHERE r.id = ?",
+            (release_id,),
+        ).fetchone()
+        if rel is None:
+            raise HTTPException(status_code=404, detail="not found")
+        roms = conn.execute(
+            "SELECT name, size, crc32, md5, sha1, serial FROM roms WHERE release_id = ?", (release_id,)
+        ).fetchall()
+        result = dict(rel)
+        result["cover"] = f"/api/cover/{release_id}"
+        result["roms"] = [dict(r) for r in roms]
+        result["meta"] = _metadata(conn, release_id, rel["system"])
+        return result
+    finally:
+        conn.close()
+
+
+@router.patch("/releases/{release_id}")
+def releases_update(release_id: int, payload: dict, user=Depends(require_role("admin", "editor"))):
+    conn = _conn()
+    try:
+        rel = conn.execute(
+            "SELECT r.id, d.system FROM releases r JOIN dats d ON d.id = r.dat_id WHERE r.id = ?",
+            (release_id,),
+        ).fetchone()
+        if rel is None:
+            raise HTTPException(status_code=404, detail="not found")
+        # release-table columns
+        for col in ("name", "region", "serial", "description"):
+            if col in payload:
+                conn.execute(f"UPDATE releases SET {col} = ? WHERE id = ?", (payload[col], release_id))
+        # metadata (item_info)
+        meta_fields = {k: payload[k] for k in _META_FIELDS if k in payload}
+        if meta_fields:
+            _save_metadata(conn, release_id, rel["system"], meta_fields)
+        conn.commit()
+        return {"ok": True}
+    finally:
+        conn.close()
+
+
+# --------------------------------------------------------------------------- #
+# covers
+# --------------------------------------------------------------------------- #
+@router.get("/cover/{release_id}")
+def cover_get(release_id: int):
+    conn = _conn()
+    try:
+        system = _release_system(conn, release_id)
+    finally:
+        conn.close()
+    if system is None:
+        raise HTTPException(status_code=404, detail="not found")
+    path = _find_cover(release_id, system)
+    if not path.exists():
+        raise HTTPException(status_code=404, detail="no cover available")
+    media = "image/jpeg" if path.suffix.lower() in (".jpg", ".jpeg") else "image/png"
+    if path.suffix.lower() == ".webp":
+        media = "image/webp"
+    return FileResponse(path, media_type=media)
+
+
+@router.post("/cover/{release_id}")
+async def cover_upload(release_id: int, file: UploadFile = File(...), user=Depends(require_role("admin", "editor"))):
+    conn = _conn()
+    try:
+        system = _release_system(conn, release_id)
+    finally:
+        conn.close()
+    if system is None:
+        raise HTTPException(status_code=404, detail="not found")
+    data = await file.read()
+    if len(data) > 20 * (1 << 20):
+        raise HTTPException(status_code=400, detail="image too large")
+    _save_cover(release_id, system, data)
+    return {"ok": True, "url": f"/api/cover/{release_id}"}
+
+
+@router.delete("/cover/{release_id}")
+def cover_delete(release_id: int, user=Depends(require_role("admin", "editor"))):
+    conn = _conn()
+    try:
+        system = _release_system(conn, release_id)
+    finally:
+        conn.close()
+    if system is None:
+        raise HTTPException(status_code=404, detail="not found")
+    path = _find_cover(release_id, system)
+    if path.exists():
+        path.unlink()
+    return {"ok": True}
+
+
+# --------------------------------------------------------------------------- #
+# store
+# --------------------------------------------------------------------------- #
+@router.get("/store")
+def store_list(system: str = Query(default="games")):
+    root = _store_root(system)
+    if not root.is_dir():
+        return {"items": [], "count": 0, "system": system}
+    items = [
+        {"name": it["name"], "filename": Path(it["path"]).name, "size": it["size"], "mtime_ns": it["mtime_ns"], "system": system}
+        for it in store.scan(root)
+    ]
+    return {"items": items, "count": len(items), "system": system}
+
+
+@router.get("/store/download/{system}/{name}")
+def store_download(system: str, name: str, user=Depends(get_current_user)):
+    root = _store_root(system).resolve()
+    target = (root / name).resolve()
+    if not target.is_file() or root not in target.parents:
+        raise HTTPException(status_code=404, detail="not found")
+    _log_download(user, system, name, target.stat().st_size)
+    return FileResponse(target, filename=name, media_type="application/octet-stream")
+
+
+@router.post("/store/upload")
+async def store_upload(system: str = Query(default="games"), file: UploadFile = File(...), user=Depends(require_role("admin", "editor"))):
+    root = _store_root(system)
+    root.mkdir(parents=True, exist_ok=True)
+    safe = _SAFE_NAME_RE.sub("", file.filename or "")
+    if not safe:
+        raise HTTPException(status_code=400, detail="invalid filename")
+    dest = root / safe
+    data = await file.read()
+    dest.write_bytes(data)
+    return {"ok": True, "filename": safe, "size": len(data)}
+
+
+@router.delete("/store/{system}/{name}")
+def store_delete(system: str, name: str, user=Depends(require_role("admin", "editor"))):
+    root = _store_root(system).resolve()
+    target = (root / name).resolve()
+    if not target.is_file() or root not in target.parents:
+        raise HTTPException(status_code=404, detail="not found")
+    target.unlink()
+    return {"ok": True}
+
+
+# --------------------------------------------------------------------------- #
+# stats (admin)
+# --------------------------------------------------------------------------- #
+@router.get("/stats")
+def stats(user=Depends(require_role("admin"))):
+    conn = _conn()
+    try:
+        systems = conn.execute(
+            "SELECT d.system AS system, COUNT(*) AS releases FROM releases r "
+            "JOIN dats d ON d.id = r.dat_id GROUP BY d.system ORDER BY d.system"
+        ).fetchall()
+        users = conn.execute("SELECT COUNT(*) AS n FROM users").fetchone()["n"]
+        covers_count = sum(1 for _ in config.COVERS_DIR.rglob("*") if _.is_file()) if config.COVERS_DIR.is_dir() else 0
+        downloads = conn.execute("SELECT COUNT(*) AS n FROM download_events").fetchone()["n"]
+        recent = conn.execute(
+            "SELECT e.system, e.name, e.bytes, e.created_at, u.username FROM download_events e "
+            "LEFT JOIN users u ON u.id = e.user_id ORDER BY e.id DESC LIMIT 20"
+        ).fetchall()
+        return {
+            "systems": [dict(r) for r in systems],
+            "users": users,
+            "covers": covers_count,
+            "downloads": downloads,
+            "recent": [dict(r) for r in recent],
+        }
+    finally:
+        conn.close()

server/config.py

@@ -0,0 +1,9 @@
+"""Server-specific settings (env-driven)."""
+import os
+from pathlib import Path
+
+from app.config import COVERS_DIR, DB_PATH, STORE_ROOT
+
+STORE_VIDEOS_ROOT = Path(os.environ.get("PSP_STORE_VIDEOS_DIR", "/data/store_videos"))
+ADMIN_USERNAME = os.environ.get("PSP_ADMIN_USERNAME", "admin")
+ADMIN_PASSWORD = os.environ.get("PSP_ADMIN_PASSWORD", "admin")

server/main.py

@@ -0,0 +1,39 @@
+"""psppt server: FastAPI app assembly."""
+import logging
+from contextlib import asynccontextmanager
+from pathlib import Path
+
+from fastapi import FastAPI
+from fastapi.staticfiles import StaticFiles
+
+from app.db import init_db
+
+from . import api, config, web
+from .security import ensure_admin
+
+log = logging.getLogger("psppt.server")
+
+
+@asynccontextmanager
+async def lifespan(_app: FastAPI):
+    init_db()
+    created = ensure_admin(config.ADMIN_USERNAME, config.ADMIN_PASSWORD)
+    if created:
+        log.warning(
+            "Created initial admin user %r with the configured password — change it now.",
+            config.ADMIN_USERNAME,
+        )
+    yield
+
+
+app = FastAPI(title="psppt server", lifespan=lifespan)
+
+app.include_router(api.router)
+app.include_router(web.router)
+
+app.mount("/static", StaticFiles(directory=str(Path(__file__).parent / "static")), name="static")
+
+
+@app.get("/health")
+def health():
+    return {"ok": True}

server/security.py

@@ -0,0 +1,138 @@
+"""Password hashing, API/session tokens, and FastAPI auth dependencies.
+
+Stdlib-only crypto: PBKDF2-SHA256 for passwords, SHA-256 hashed bearer tokens
+for both the desktop client (kind="api") and the WebUI session (kind="session").
+"""
+import hashlib
+import secrets
+from datetime import datetime, timezone
+
+from fastapi import Depends, Header, HTTPException, Request, status
+
+from app.db import get_connection
+
+_PBKDF2_ITERATIONS = 600_000
+
+ADMIN_ROLE = "admin"
+EDITOR_ROLE = "editor"
+USER_ROLE = "user"
+ROLES = (ADMIN_ROLE, EDITOR_ROLE, USER_ROLE)
+
+
+def now_iso():
+    return datetime.now(timezone.utc).isoformat(timespec="seconds")
+
+
+def hash_password(password: str) -> str:
+    salt = secrets.token_bytes(16)
+    digest = hashlib.pbkdf2_hmac("sha256", password.encode("utf-8"), salt, _PBKDF2_ITERATIONS)
+    return f"pbkdf2_sha256${_PBKDF2_ITERATIONS}${salt.hex()}${digest.hex()}"
+
+
+def verify_password(password: str, stored: str) -> bool:
+    try:
+        scheme, iterations, salt_hex, digest_hex = stored.split("$")
+        if scheme != "pbkdf2_sha256":
+            return False
+        salt = bytes.fromhex(salt_hex)
+        expected = bytes.fromhex(digest_hex)
+        actual = hashlib.pbkdf2_hmac("sha256", password.encode("utf-8"), salt, int(iterations))
+        return secrets.compare_digest(actual, expected)
+    except (ValueError, TypeError):
+        return False
+
+
+def _hash_token(raw: str) -> str:
+    return hashlib.sha256(raw.encode("utf-8")).hexdigest()
+
+
+def issue_token(user_id: int, kind: str = "api", label: str = "", expires_at: str = "") -> str:
+    """Create a token row and return the raw token (only shown once)."""
+    raw = secrets.token_urlsafe(32)
+    conn = get_connection()
+    try:
+        conn.execute(
+            "INSERT INTO api_tokens (user_id, token_hash, label, kind, created_at, last_used_at, expires_at, revoked_at) "
+            "VALUES (?, ?, ?, ?, ?, ?, ?, NULL)",
+            (user_id, _hash_token(raw), label, kind, now_iso(), now_iso(), expires_at or None),
+        )
+        conn.commit()
+    finally:
+        conn.close()
+    return raw
+
+
+def revoke_token(raw: str) -> None:
+    conn = get_connection()
+    try:
+        conn.execute(
+            "UPDATE api_tokens SET revoked_at = ? WHERE token_hash = ?",
+            (now_iso(), _hash_token(raw)),
+        )
+        conn.commit()
+    finally:
+        conn.close()
+
+
+def get_user_by_token(raw: str):
+    if not raw:
+        return None
+    conn = get_connection()
+    try:
+        row = conn.execute(
+            "SELECT u.id, u.username, u.role, u.is_active FROM api_tokens t "
+            "JOIN users u ON u.id = t.user_id "
+            "WHERE t.token_hash = ? AND t.revoked_at IS NULL "
+            "AND (t.expires_at IS NULL OR t.expires_at = '' OR t.expires_at > ?)",
+            (_hash_token(raw), now_iso()),
+        ).fetchone()
+        if row is None or not row["is_active"]:
+            return None
+        conn.execute(
+            "UPDATE api_tokens SET last_used_at = ? WHERE token_hash = ?",
+            (now_iso(), _hash_token(raw)),
+        )
+        conn.commit()
+        return dict(row)
+    finally:
+        conn.close()
+
+
+def get_current_user(request: Request, authorization: str = Header(default="")):
+    """Authenticate via ``Authorization: Bearer`` (client) or session cookie (WebUI)."""
+    token = ""
+    if authorization.startswith("Bearer "):
+        token = authorization[7:].strip()
+    else:
+        token = request.cookies.get("psppt_session", "")
+    user = get_user_by_token(token)
+    if user is None:
+        raise HTTPException(status_code=status.HTTP_401_UNAUTHORIZED, detail="Not authenticated")
+    return user
+
+
+def require_role(*roles):
+    """Dependency factory: only users with one of ``roles`` may pass."""
+    def dependency(user=Depends(get_current_user)):
+        if user["role"] not in roles:
+            raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="Insufficient permissions")
+        return user
+    return dependency
+
+
+def ensure_admin(username: str, password: str) -> bool:
+    """Create the initial admin account when the users table is empty."""
+    conn = get_connection()
+    try:
+        count = conn.execute("SELECT COUNT(*) AS n FROM users").fetchone()["n"]
+        if count == 0:
+            conn.execute(
+                "INSERT INTO users (username, password_hash, role, is_active, created_at) "
+                "VALUES (?, ?, 'admin', 1, ?)",
+                (username, hash_password(password), now_iso()),
+            )
+            conn.commit()
+            return True
+    finally:
+        conn.close()
+    return False

server/static/app.css

@@ -0,0 +1,52 @@
+:root { color-scheme: dark; }
+* { box-sizing: border-box; }
+body {
+  margin: 0; font-family: system-ui, -apple-system, Segoe UI, Roboto, sans-serif;
+  background: #12131a; color: #e8e9ed; line-height: 1.45;
+}
+nav {
+  display: flex; align-items: center; gap: 16px; padding: 10px 20px;
+  background: #1a1c26; border-bottom: 1px solid #2a2d3a;
+}
+nav a { color: #9fb4ff; text-decoration: none; font-weight: 600; }
+nav a:hover { color: #c7d3ff; }
+nav .spacer { flex: 1; }
+nav .who { color: #8a8da0; font-size: 0.9em; }
+main { max-width: 1100px; margin: 0 auto; padding: 24px 20px 60px; }
+h1 { font-size: 1.6em; margin-top: 0; }
+h2 { font-size: 1.15em; margin-top: 28px; color: #b9bdd0; }
+.card { background: #1a1c26; border: 1px solid #2a2d3a; border-radius: 10px; padding: 24px; }
+.card.narrow { max-width: 380px; margin: 60px auto; }
+form label { display: block; margin: 10px 0 2px; font-size: 0.85em; color: #9aa0b5; }
+input, select, textarea {
+  width: 100%; padding: 8px 10px; border-radius: 6px; border: 1px solid #34384a;
+  background: #0f1016; color: #e8e9ed; font: inherit;
+}
+form.inline { display: flex; gap: 8px; align-items: center; flex-wrap: wrap; }
+form.inline input, form.inline select { width: auto; }
+form.filters input { width: 220px; }
+form.grid { display: grid; grid-template-columns: 1fr 1fr; gap: 4px 18px; max-width: 760px; }
+form.grid .wide { grid-column: 1 / -1; }
+button {
+  padding: 8px 16px; border: 0; border-radius: 6px; cursor: pointer;
+  background: #3b5bdb; color: #fff; font: inherit; font-weight: 600;
+}
+button:hover { background: #4c6ef5; }
+button.ghost { background: transparent; border: 1px solid #34384a; color: #c7cadb; }
+button.danger { background: #b03a3a; }
+button.danger:hover { background: #d14a4a; }
+table { width: 100%; border-collapse: collapse; margin-top: 12px; font-size: 0.95em; }
+th, td { text-align: left; padding: 7px 10px; border-bottom: 1px solid #262936; }
+th { color: #9aa0b5; font-weight: 600; }
+tr:hover td { background: #171923; }
+.cards { display: flex; gap: 14px; flex-wrap: wrap; }
+.stat { flex: 1; min-width: 120px; background: #1a1c26; border: 1px solid #2a2d3a;
+  border-radius: 10px; padding: 16px; text-align: center; }
+.stat b { display: block; font-size: 1.7em; }
+.stat span { color: #8a8da0; font-size: 0.85em; }
+.error { color: #ff8787; }
+.muted { color: #8a8da0; }
+.cover { max-width: 200px; border-radius: 8px; border: 1px solid #2a2d3a; margin-bottom: 10px; }
+code { background: #0f1016; padding: 2px 6px; border-radius: 4px; }
+label.check { display: flex; align-items: center; gap: 6px; margin: 0; }
+label.check input { width: auto; }

server/templates/base.html

@@ -0,0 +1,26 @@
+<!doctype html>
+<html lang="en">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <title>{% block title %}psppt server{% endblock %}</title>
+  <link rel="stylesheet" href="/static/app.css">
+</head>
+<body>
+  {% if user %}
+  <nav>
+    <a href="/dashboard">Dashboard</a>
+    <a href="/releases">Games &amp; Videos</a>
+    {% if user.role in ('admin', 'editor') %}<a href="/store">Store</a>{% endif %}
+    {% if user.role == 'admin' %}<a href="/users">Users</a>{% endif %}
+    {% if user.role == 'admin' %}<a href="/settings">Settings</a>{% endif %}
+    <span class="spacer"></span>
+    <span class="who">{{ user.username }} · {{ user.role }}</span>
+    <form method="post" action="/logout" class="inline"><button class="ghost">Logout</button></form>
+  </nav>
+  {% endif %}
+  <main>
+    {% block content %}{% endblock %}
+  </main>
+</body>
+</html>

server/templates/dashboard.html

@@ -0,0 +1,37 @@
+{% extends "base.html" %}
+{% block title %}Dashboard · psppt{% endblock %}
+{% block content %}
+<h1>Dashboard</h1>
+<div class="cards">
+  <div class="stat"><b>{{ users }}</b><span>users</span></div>
+  <div class="stat"><b>{{ downloads }}</b><span>downloads</span></div>
+  <div class="stat"><b>{{ covers }}</b><span>covers</span></div>
+  <div class="stat"><b>{{ store_games }}</b><span>game archives</span></div>
+  <div class="stat"><b>{{ store_videos }}</b><span>video archives</span></div>
+</div>
+
+<h2>Catalog</h2>
+<ul>
+  {% for s in systems %}
+  <li>{{ s.system }} — {{ s.releases }} release(s)</li>
+  {% else %}
+  <li>No catalog data ingested yet.</li>
+  {% endfor %}
+</ul>
+
+<h2>Recent downloads</h2>
+<table>
+  <tr><th>When</th><th>User</th><th>System</th><th>Name</th><th>Size</th></tr>
+  {% for r in recent %}
+  <tr>
+    <td>{{ r.created_at }}</td>
+    <td>{{ r.username or '—' }}</td>
+    <td>{{ r.system }}</td>
+    <td>{{ r.name }}</td>
+    <td>{{ (r.bytes / 1048576) | round(1) }} MB</td>
+  </tr>
+  {% else %}
+  <tr><td colspan="5">No downloads yet.</td></tr>
+  {% endfor %}
+</table>
+{% endblock %}

server/templates/login.html

@@ -0,0 +1,13 @@
+{% extends "base.html" %}
+{% block title %}Login · psppt{% endblock %}
+{% block content %}
+<div class="card narrow">
+  <h1>psppt server</h1>
+  {% if error %}<p class="error">{{ error }}</p>{% endif %}
+  <form method="post" action="/login">
+    <label>Username <input name="username" required autofocus></label>
+    <label>Password <input name="password" type="password" required></label>
+    <button>Log in</button>
+  </form>
+</div>
+{% endblock %}

server/templates/release_edit.html

@@ -0,0 +1,31 @@
+{% extends "base.html" %}
+{% block title %}{{ rel.name }} · psppt{% endblock %}
+{% block content %}
+<p><a href="/releases">← back</a></p>
+<h1>{{ rel.name }}</h1>
+<form method="post" action="/releases/{{ rel.id }}/edit" class="grid">
+  <label>Name <input name="name" value="{{ rel.name }}"></label>
+  <label>Region <input name="region" value="{{ rel.region or '' }}"></label>
+  <label>Serial <input name="serial" value="{{ rel.serial or '' }}"></label>
+  <label>Description <textarea name="description">{{ rel.description or '' }}</textarea></label>
+  <label>Title <input name="title" value="{{ meta.title or '' }}"></label>
+  <label>Release date <input name="release_date" value="{{ meta.release_date or '' }}"></label>
+  <label>Developer <input name="developer" value="{{ meta.developer or '' }}"></label>
+  <label>Publisher <input name="publisher" value="{{ meta.publisher or '' }}"></label>
+  <label>Genre <input name="genre" value="{{ meta.genre or '' }}"></label>
+  <label class="wide">Synopsis <textarea name="synopsis">{{ meta.synopsis or '' }}</textarea></label>
+  <button>Save</button>
+</form>
+
+<h2>Cover</h2>
+{% if has_cover %}<img src="/api/cover/{{ rel.id }}" class="cover" alt="cover">{% else %}<p class="muted">No cover.</p>{% endif %}
+<form method="post" action="/releases/{{ rel.id }}/cover" enctype="multipart/form-data" class="inline">
+  <input type="file" name="cover" accept="image/*">
+  <button>Upload cover</button>
+</form>
+{% if has_cover %}
+<form method="post" action="/releases/{{ rel.id }}/cover/delete" class="inline">
+  <button class="danger">Delete cover</button>
+</form>
+{% endif %}
+{% endblock %}

server/templates/releases.html

@@ -0,0 +1,29 @@
+{% extends "base.html" %}
+{% block title %}Games & Videos · psppt{% endblock %}
+{% block content %}
+<h1>Games &amp; Videos</h1>
+<form method="get" action="/releases" class="filters">
+  <select name="system">
+    <option value="">All systems</option>
+    <option value="games" {% if system == 'games' %}selected{% endif %}>Games</option>
+    <option value="videos" {% if system == 'videos' %}selected{% endif %}>Videos</option>
+  </select>
+  <input name="q" value="{{ q }}" placeholder="Search…">
+  <button>Filter</button>
+</form>
+<table>
+  <tr><th>Name</th><th>System</th><th>Region</th><th>Serial</th><th>Cover</th><th></th></tr>
+  {% for it in items %}
+  <tr>
+    <td>{{ it.name }}</td>
+    <td>{{ it.system }}</td>
+    <td>{{ it.region or '' }}</td>
+    <td>{{ it.serial or '' }}</td>
+    <td>{% if it.has_cover %}✓{% else %}—{% endif %}</td>
+    <td><a href="/releases/{{ it.id }}/edit">Edit</a></td>
+  </tr>
+  {% else %}
+  <tr><td colspan="6">Nothing found.</td></tr>
+  {% endfor %}
+</table>
+{% endblock %}

server/templates/settings.html

@@ -0,0 +1,11 @@
+{% extends "base.html" %}
+{% block title %}Settings · psppt{% endblock %}
+{% block content %}
+<h1>Settings</h1>
+<ul>
+  <li>Store root (games): <code>{{ store_root }}</code></li>
+  <li>Store root (videos): <code>{{ store_videos_root }}</code></li>
+  <li>Covers directory: <code>{{ covers_dir }}</code></li>
+</ul>
+<p class="muted">These paths are configured via environment variables — restart the server to change them.</p>
+{% endblock %}

server/templates/store.html

@@ -0,0 +1,50 @@
+{% extends "base.html" %}
+{% block title %}Store · psppt{% endblock %}
+{% block content %}
+<h1>Store</h1>
+<h2>Upload archive</h2>
+<form method="post" action="/store/upload" enctype="multipart/form-data" class="inline">
+  <select name="system">
+    <option value="games">Games</option>
+    <option value="videos">Videos</option>
+  </select>
+  <input type="file" name="file">
+  <button>Upload</button>
+</form>
+
+<h2>Games ({{ games | length }})</h2>
+<table>
+  <tr><th>Name</th><th>Size</th><th></th></tr>
+  {% for g in games %}
+  <tr>
+    <td>{{ g.name }}</td>
+    <td>{{ (g.size / 1048576) | round(1) }} MB</td>
+    <td>
+      <form method="post" action="/store/games/{{ g.filename }}/delete" class="inline">
+        <button class="danger">Delete</button>
+      </form>
+    </td>
+  </tr>
+  {% else %}
+  <tr><td colspan="3">No game archives.</td></tr>
+  {% endfor %}
+</table>
+
+<h2>Videos ({{ videos | length }})</h2>
+<table>
+  <tr><th>Name</th><th>Size</th><th></th></tr>
+  {% for v in videos %}
+  <tr>
+    <td>{{ v.name }}</td>
+    <td>{{ (v.size / 1048576) | round(1) }} MB</td>
+    <td>
+      <form method="post" action="/store/videos/{{ v.filename }}/delete" class="inline">
+        <button class="danger">Delete</button>
+      </form>
+    </td>
+  </tr>
+  {% else %}
+  <tr><td colspan="3">No video archives.</td></tr>
+  {% endfor %}
+</table>
+{% endblock %}

server/templates/users.html

@@ -0,0 +1,41 @@
+{% extends "base.html" %}
+{% block title %}Users · psppt{% endblock %}
+{% block content %}
+<h1>Users</h1>
+<h2>Add user</h2>
+<form method="post" action="/users" class="inline">
+  <input name="username" placeholder="username" required>
+  <input name="password" type="password" placeholder="password" required>
+  <select name="role">
+    <option value="user">user</option>
+    <option value="editor">editor</option>
+    <option value="admin">admin</option>
+  </select>
+  <button>Add</button>
+</form>
+
+<h2>Existing</h2>
+<table>
+  <tr><th>Username</th><th>Role</th><th>Active</th><th>Actions</th></tr>
+  {% for u in users %}
+  <tr>
+    <td>{{ u.username }}</td>
+    <td>{{ u.role }}</td>
+    <td>{{ 'yes' if u.is_active else 'no' }}</td>
+    <td>
+      <form method="post" action="/users/{{ u.id }}" class="inline">
+        <select name="role">
+          <option value="user" {% if u.role == 'user' %}selected{% endif %}>user</option>
+          <option value="editor" {% if u.role == 'editor' %}selected{% endif %}>editor</option>
+          <option value="admin" {% if u.role == 'admin' %}selected{% endif %}>admin</option>
+        </select>
+        <input name="password" type="password" placeholder="new password">
+        <label class="check"><input type="checkbox" name="is_active" {% if u.is_active %}checked{% endif %}> active</label>
+        <button name="action" value="save">Save</button>
+        <button name="action" value="delete" class="danger">Delete</button>
+      </form>
+    </td>
+  </tr>
+  {% endfor %}
+</table>
+{% endblock %}

server/web.py

@@ -0,0 +1,339 @@
+"""Server-rendered admin WebUI (Jinja2, plain HTML forms — no JS build)."""
+from pathlib import Path
+
+from fastapi import APIRouter, Depends, HTTPException, Request, status
+from fastapi.responses import RedirectResponse
+from fastapi.templating import Jinja2Templates
+
+from app import store as store_mod
+from app.db import get_connection
+
+from . import config
+from .api import _find_cover, _metadata, _release_system, _store_root, _SAFE_NAME_RE
+from .security import get_user_by_token, hash_password, issue_token, now_iso, require_role, revoke_token, verify_password
+
+router = APIRouter(include_in_schema=False)
+templates = Jinja2Templates(directory=str(Path(__file__).parent / "templates"))
+
+
+def _render(request, name, **ctx):
+    ctx.setdefault("user", getattr(request.state, "user", None))
+    return templates.TemplateResponse(request, name, ctx)
+
+
+def web_user(request: Request) -> dict:
+    user = get_user_by_token(request.cookies.get("psppt_session", ""))
+    if user is None:
+        raise HTTPException(status_code=status.HTTP_303_SEE_OTHER, headers={"Location": "/login"})
+    request.state.user = user
+    return user
+
+
+def web_admin(request: Request, user=Depends(web_user)) -> dict:
+    if user["role"] != "admin":
+        raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="Admin only")
+    return user
+
+
+def web_editor(request: Request, user=Depends(web_user)) -> dict:
+    if user["role"] not in ("admin", "editor"):
+        raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="Editor or admin required")
+    return user
+
+
+# --------------------------------------------------------------------------- #
+# auth pages
+# --------------------------------------------------------------------------- #
+@router.get("/login")
+def login_page(request: Request):
+    return _render(request, "login.html")
+
+
+@router.post("/login")
+async def login_submit(request: Request):
+    form = await request.form()
+    username = (form.get("username") or "").strip()
+    password = form.get("password") or ""
+    conn = get_connection()
+    try:
+        row = conn.execute(
+            "SELECT id, username, password_hash, role, is_active FROM users WHERE username = ?", (username,)
+        ).fetchone()
+    finally:
+        conn.close()
+    if row is None or not row["is_active"] or not verify_password(password, row["password_hash"]):
+        return _render(request, "login.html", error="Invalid username or password")
+    token = issue_token(row["id"], kind="session", label="web session")
+    conn = get_connection()
+    try:
+        conn.execute("UPDATE users SET last_login_at = ? WHERE id = ?", (now_iso(), row["id"]))
+        conn.commit()
+    finally:
+        conn.close()
+    resp = RedirectResponse("/dashboard", status_code=status.HTTP_303_SEE_OTHER)
+    resp.set_cookie("psppt_session", token, httponly=True, samesite="lax", path="/")
+    return resp
+
+
+@router.post("/logout")
+def logout(request: Request):
+    token = request.cookies.get("psppt_session", "")
+    if token:
+        revoke_token(token)
+    resp = RedirectResponse("/login", status_code=status.HTTP_303_SEE_OTHER)
+    resp.delete_cookie("psppt_session", path="/")
+    return resp
+
+
+# --------------------------------------------------------------------------- #
+# dashboard
+# --------------------------------------------------------------------------- #
+@router.get("/")
+def root():
+    return RedirectResponse("/dashboard", status_code=status.HTTP_303_SEE_OTHER)
+
+
+@router.get("/dashboard")
+def dashboard(request: Request, user=Depends(web_user)):
+    conn = get_connection()
+    try:
+        systems = conn.execute(
+            "SELECT d.system AS system, COUNT(*) AS releases FROM releases r "
+            "JOIN dats d ON d.id = r.dat_id GROUP BY d.system ORDER BY d.system"
+        ).fetchall()
+        users = conn.execute("SELECT COUNT(*) AS n FROM users").fetchone()["n"]
+        downloads = conn.execute("SELECT COUNT(*) AS n FROM download_events").fetchone()["n"]
+        covers = sum(1 for _ in config.COVERS_DIR.rglob("*") if _.is_file()) if config.COVERS_DIR.is_dir() else 0
+        recent = conn.execute(
+            "SELECT e.system, e.name, e.bytes, e.created_at, u.username FROM download_events e "
+            "LEFT JOIN users u ON u.id = e.user_id ORDER BY e.id DESC LIMIT 15"
+        ).fetchall()
+    finally:
+        conn.close()
+    store_games = len(store_mod.scan(config.STORE_ROOT)) if config.STORE_ROOT.is_dir() else 0
+    store_videos = len(store_mod.scan(config.STORE_VIDEOS_ROOT)) if config.STORE_VIDEOS_ROOT.is_dir() else 0
+    return _render(request, "dashboard.html", systems=[dict(r) for r in systems], users=users,
+                   downloads=downloads, covers=covers, recent=[dict(r) for r in recent],
+                   store_games=store_games, store_videos=store_videos)
+
+
+# --------------------------------------------------------------------------- #
+# releases (games / videos browser)
+# --------------------------------------------------------------------------- #
+@router.get("/releases")
+def releases_page(request: Request, system: str = "", q: str = "", user=Depends(web_user)):
+    sql = "SELECT r.id, d.system, r.name, r.region, r.serial FROM releases r JOIN dats d ON d.id = r.dat_id"
+    where, params = [], []
+    if system:
+        where.append("d.system = ?")
+        params.append(system)
+    if q:
+        where.append("r.name LIKE ?")
+        params.append(f"%{q}%")
+    if where:
+        sql += " WHERE " + " AND ".join(where)
+    sql += " ORDER BY r.name LIMIT 200"
+    conn = get_connection()
+    try:
+        rows = conn.execute(sql, params).fetchall()
+        items = []
+        for r in rows:
+            d = dict(r)
+            d["has_cover"] = _find_cover(r["id"], r["system"]).exists()
+            items.append(d)
+    finally:
+        conn.close()
+    return _render(request, "releases.html", items=items, system=system, q=q)
+
+
+@router.get("/releases/{release_id}/edit")
+def release_edit_page(release_id: int, request: Request, user=Depends(web_editor)):
+    conn = get_connection()
+    try:
+        rel = conn.execute(
+            "SELECT r.id, d.system, r.name, r.description, r.region, r.serial "
+            "FROM releases r JOIN dats d ON d.id = r.dat_id WHERE r.id = ?",
+            (release_id,),
+        ).fetchone()
+        if rel is None:
+            raise HTTPException(status_code=404, detail="not found")
+        meta = _metadata(conn, release_id, rel["system"])
+    finally:
+        conn.close()
+    has_cover = _find_cover(release_id, rel["system"]).exists()
+    return _render(request, "release_edit.html", rel=dict(rel), meta=meta, has_cover=has_cover)
+
+
+@router.post("/releases/{release_id}/edit")
+async def release_edit_save(release_id: int, request: Request, user=Depends(web_editor)):
+    form = await request.form()
+    conn = get_connection()
+    try:
+        rel = conn.execute(
+            "SELECT d.system FROM releases r JOIN dats d ON d.id = r.dat_id WHERE r.id = ?", (release_id,)
+        ).fetchone()
+        if rel is None:
+            raise HTTPException(status_code=404, detail="not found")
+        conn.execute(
+            "UPDATE releases SET name = ?, region = ?, serial = ?, description = ? WHERE id = ?",
+            (form.get("name") or "", form.get("region") or "", form.get("serial") or "",
+             form.get("description") or "", release_id),
+        )
+        meta = {}
+        for k in ("title", "release_date", "developer", "publisher", "genre", "synopsis"):
+            v = form.get(k)
+            if v is not None and str(v).strip():
+                meta[k] = str(v).strip()
+        if meta:
+            from .api import _save_metadata
+            _save_metadata(conn, release_id, rel["system"], meta)
+        conn.commit()
+    finally:
+        conn.close()
+    return RedirectResponse(f"/releases/{release_id}/edit", status_code=status.HTTP_303_SEE_OTHER)
+
+
+@router.post("/releases/{release_id}/cover")
+async def release_cover_upload(release_id: int, request: Request, user=Depends(web_editor)):
+    from .api import _save_cover
+    form = await request.form()
+    file = form.get("cover")
+    if file is None or not getattr(file, "filename", ""):
+        raise HTTPException(status_code=400, detail="no file")
+    data = await file.read()
+    conn = get_connection()
+    try:
+        system = _release_system(conn, release_id)
+    finally:
+        conn.close()
+    if system is None:
+        raise HTTPException(status_code=404, detail="not found")
+    _save_cover(release_id, system, data)
+    return RedirectResponse(f"/releases/{release_id}/edit", status_code=status.HTTP_303_SEE_OTHER)
+
+
+@router.post("/releases/{release_id}/cover/delete")
+def release_cover_delete(release_id: int, user=Depends(web_editor)):
+    from .api import _find_cover
+    conn = get_connection()
+    try:
+        system = _release_system(conn, release_id)
+    finally:
+        conn.close()
+    if system:
+        p = _find_cover(release_id, system)
+        if p.exists():
+            p.unlink()
+    return RedirectResponse(f"/releases/{release_id}/edit", status_code=status.HTTP_303_SEE_OTHER)
+
+
+# --------------------------------------------------------------------------- #
+# users (admin)
+# --------------------------------------------------------------------------- #
+@router.get("/users")
+def users_page(request: Request, user=Depends(web_admin)):
+    conn = get_connection()
+    try:
+        rows = conn.execute(
+            "SELECT id, username, role, is_active, created_at, last_login_at FROM users ORDER BY username"
+        ).fetchall()
+    finally:
+        conn.close()
+    return _render(request, "users.html", users=[dict(r) for r in rows])
+
+
+@router.post("/users")
+async def users_create(request: Request, user=Depends(web_admin)):
+    form = await request.form()
+    username = (form.get("username") or "").strip()
+    password = form.get("password") or ""
+    role = form.get("role") or "user"
+    if not username or not password:
+        raise HTTPException(status_code=400, detail="username and password required")
+    conn = get_connection()
+    try:
+        try:
+            conn.execute(
+                "INSERT INTO users (username, password_hash, role, is_active, created_at) VALUES (?, ?, ?, 1, ?)",
+                (username, hash_password(password), role, now_iso()),
+            )
+            conn.commit()
+        except Exception:
+            raise HTTPException(status_code=409, detail="username already exists")
+    finally:
+        conn.close()
+    return RedirectResponse("/users", status_code=status.HTTP_303_SEE_OTHER)
+
+
+@router.post("/users/{user_id}")
+async def users_update(user_id: int, request: Request, user=Depends(web_admin)):
+    form = await request.form()
+    action = form.get("action") or ""
+    conn = get_connection()
+    try:
+        if action == "delete":
+            if user_id != user["id"]:
+                conn.execute("DELETE FROM users WHERE id = ?", (user_id,))
+        else:
+            role = form.get("role")
+            if role in ("admin", "editor", "user"):
+                conn.execute("UPDATE users SET role = ? WHERE id = ?", (role, user_id))
+            conn.execute("UPDATE users SET is_active = ? WHERE id = ?", (1 if form.get("is_active") else 0, user_id))
+            pw = form.get("password") or ""
+            if pw:
+                conn.execute("UPDATE users SET password_hash = ? WHERE id = ?", (hash_password(pw), user_id))
+        conn.commit()
+    finally:
+        conn.close()
+    return RedirectResponse("/users", status_code=status.HTTP_303_SEE_OTHER)
+
+
+# --------------------------------------------------------------------------- #
+# store management (editor+)
+# --------------------------------------------------------------------------- #
+@router.get("/store")
+def store_page(request: Request, user=Depends(web_editor)):
+    def _rows(root):
+        out = []
+        for it in store_mod.scan(root):
+            out.append({"name": it["name"], "filename": Path(it["path"]).name, "size": it["size"]})
+        return out
+    games = _rows(config.STORE_ROOT) if config.STORE_ROOT.is_dir() else []
+    videos = _rows(config.STORE_VIDEOS_ROOT) if config.STORE_VIDEOS_ROOT.is_dir() else []
+    return _render(request, "store.html", games=games, videos=videos)
+
+
+@router.post("/store/upload")
+async def store_upload(request: Request, user=Depends(web_editor)):
+    form = await request.form()
+    system = form.get("system") or "games"
+    file = form.get("file")
+    if file is None or not getattr(file, "filename", ""):
+        raise HTTPException(status_code=400, detail="no file")
+    data = await file.read()
+    root = _store_root(system)
+    root.mkdir(parents=True, exist_ok=True)
+    safe = _SAFE_NAME_RE.sub("", file.filename or "")
+    if not safe:
+        raise HTTPException(status_code=400, detail="invalid filename")
+    (root / safe).write_bytes(data)
+    return RedirectResponse("/store", status_code=status.HTTP_303_SEE_OTHER)
+
+
+@router.post("/store/{system}/{name}/delete")
+def store_delete(system: str, name: str, user=Depends(web_editor)):
+    root = _store_root(system).resolve()
+    target = (root / name).resolve()
+    if target.is_file() and root in target.parents:
+        target.unlink()
+    return RedirectResponse("/store", status_code=status.HTTP_303_SEE_OTHER)
+
+
+# --------------------------------------------------------------------------- #
+# settings (admin)
+# --------------------------------------------------------------------------- #
+@router.get("/settings")
+def settings_page(request: Request, user=Depends(web_admin)):
+    return _render(request, "settings.html",
+                   store_root=config.STORE_ROOT, store_videos_root=config.STORE_VIDEOS_ROOT,
+                   covers_dir=config.COVERS_DIR)